Property & Relevance Examples

This page has not been liked. Updated 2/26/14 7:04 AM by KarenKueTags: None

Retrieved Properties

 

Important note: This documentation is provided for reference purposes only. The information contained in this documentation is provided “as is” without any warranty, express or implied. The properties and any customization made to them are not handled by IBM Support.
 
Retrieved properties are system attributes that are reported from the client to the server. Virtually any information or attribute about a computer can be viewed using retrieved properties. The retrieved properties will show up in the computer lists and the Computer Status dialog. Retrieved properties can also be used in the IBM Endpoint Manager Web Reports. Listed below are some commonly requested retrieved properties.
 
Click here for more information about how to define additional custom retrieved properties for IBM Endpoint Manager.
 
Note: Many of the most common properties are incorporated with the "Analyses" tab. View the Analyses in the console to activate these groups of properties.
 
Notes on additional retrieved properties:
  • Many of these properties are specifically designed to work on Microsoft Windows.
  • Some properties will not work on certain versions of Microsoft Windows and will return "<error>".
  • Some properties will return "<multiple results>" if more than one result is returned for a property (all the results can be viewed in the Computer Status > Properties dialog in the console).
  • These properties can be customized modifying the relevance expression - As noted earlier, custom content is not handled by IBM support. You can use the IBM Endpoint Manager forums to gather information on customizations.
  • To use these properties, simply cut and paste the Relevance into the desired field within IBM Endpoint Manager.
 

Types of Properties

Note: The relevance may have been edited with extra spaces to fit in column table.

Application

Property Name Description Example Return Value Additional Notes Relevance

Registered Applications

The name, version, vendor, etc. for all registered applications on the given computer.

"BESClient.exe" "8.1.617.0" "BigFix BESClient Application" "8.1.617.0" "IBM Inc." 

Not all applications register themselves with the OS

regapps

Running Applications

The name, version, vendor, etc. for each running application

"iexplore.exe" "6.0.2800.1106" "Internet Explorer" "6.00.2800.1106 (xpsp1.020828-1920)" "Microsoft Corporation" 

 

running applications

Recent Applications

The name, version, vendor, etc. for each application that has been started recently

"iexplore.exe" "6.0.2800.1106" "Internet Explorer" "6.00.2800.1106 (xpsp1.020828-1920)" "Microsoft Corporation" 

The recent applications are applications that have been started (or are running) since the BigFix Client service started

recent applications

Running Services

The service name, display name, and state of each running service

"Norton AntiVirus Server" "Norton AntiVirus Client" "Running"

 

running services

TEM Client version

Version of the TEM Client

8.1.617.0

 

version of regapp "BESClient.exe"

BigFix Client Installation Time

The time the BigFix Client was first installed.

Tue, 10 Jun 2003 09:13:11 -0700

This not be reset if the BigFix Client is uninstalled then reinstalled unless the __BESData folder in the BigFix Client folder is removed.

subscribe time of current site

Installed Applications

Lists all application names in the Add/Remove Programs list

WinZip 

BigFix Enterprise Client 

Not all applications register themselves with the Add/Remove Programs

(values "DisplayName" of it) of keys whose (exists value "DisplayName" of it AND exists value "UninstallString" of it) of key "HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall" of registry

Running Office Applications

Lists the executable names of running Microsoft Office applications

WINWORD.EXE / OUTLOOK.EXE …

Detects PowerPoint, Excel, Word, Outlook, Publisher, Access, FrontPage, InfoPath, OneNote, Project, and Visio.

if (exists running applications ("powerpnt.exe";"excel.exe";"winword.exe"; outlook.exe";"mspub.exe";"msaccess.exe"; "frontpg.exe";"infopath.exe";"onenote.exe"; "winproj.exe";"visio.exe")) then (concatenation " / " of names of running applications ("powerpnt.exe";"excel.exe";"winword.exe"; "outlook.exe";"mspub.exe";"msaccess.exe"; "frontpg.exe";"infopath.exe";"onenote.exe"; "winproj.exe";"visio.exe")) else "No Office Application Running"

Office Version

Version of Microsoft Office

Microsoft Office XP Small Business - 10.0.4330.0

This property will return each Office version if multiple Office versions are installed

(value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" - " & value "DisplayVersion" of it as string) else "")) of keys whose ((exists value "DisplayName" of it) AND (value "DisplayName" of it as string as lowercase contains "microsoft office") and (value "DisplayName" of it as string as lowercase does not contain "media content") and (value "DisplayName" of it as string as lowercase does not contain "integration") and (value "DisplayName" of it as string as lowercase does not contain "sounds")) of key "HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall" of registry

 

Virus Scanning Products

 

Property Name< Description Example Return Value Additional Notes Relevance

Norton Running

Checks if the Norton AntiVirus services are currently running

Running/Stopped/Not Installed

Looks for the Norton and Symantec AntiVirus services (Client or Server) and reports the current state of a service if found. Returns "Not Installed" if a service for Norton is not found. Warning: This property only works on NT based versions of Windows (not Windows 9x).

if (exists service "norton antivirus server") then (state of service "norton antivirus server") else (if (exists service "norton antivirus client") then (state of service "norton antivirus client") else (if (exists service "symantec antivirus server") then (state of service "symantec antivirus server") else (if (exists service "symantec antivirus client") then (state of service "symantec antivirus client") else (if (exists service "symantec antivirus") then (state of service "symantec antivirus") else (if (exists service "navapsvc") then (state of service "navapsvc") else "Not Installed")))))

McAfee Running

Checks if the McAfee VirusScan executables are currently running

True/False/Not Installed

Looks specifically for the running applications "vshwin32.exe" or "mcshield.exe"; returns "Not Installed" if the services or registry keys for McAfee VirusScan are not detected.

if ( (exists service "mcshield") OR (exists key "HKEY_LOCAL_MACHINE\Software\ Network Associates\TVD\VirusScan" of registry) ) then ( (exists running application "vshwin32.exe") OR (exists running application "mcshield.exe") ) as string else "Not Installed"

McAfee Running

Checks if the McAfee VirusScan executables are currently running

True/False/Not Installed

Looks specifically for the running applications "vshwin32.exe" or "mcshield.exe"; returns "Not Installed" if the services or registry keys for McAfee VirusScan are not detected.

if ( (exists service "mcshield") OR (exists key "HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\VirusScan" of registry) ) then ( (exists running application "vshwin32.exe") OR (exists running application "mcshield.exe") ) as string else "Not Installed"

TrendMicro Running

Checks if the TrendMicro executables or services are currently running

True/False/Not Installed

Looks specifically for the running application "pccwin97.exe" or the running services "SpntSvc", "ntrtscan", or "tmlisten"; returns "Not Installed" if the registry keys for TrendMicro are not detected.

if ( (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ TrendMicro" of registry) ) then ( (exists running service "tmlisten" and exists running service "ntrtscan") OR (exists running application "pccwin97.exe") OR (exists running service "SpntSvc") ) as string else "Not Installed"

eTrust Running

Checks if the eTrust executables or services are currently running

True/False/Not Installed

Looks specifically the running services "InoRPC", "InoTask", or "InoRT"; returns "Not Installed" if the registry keys for eTrust are not detected.

if ( (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ ComputerAssociates" of registry) OR (exists regapp "inocit.exe") ) then ( (exists running service "InoRPC") AND (exists running service "InoRT") AND (exists running service "InoTask") ) as string else "Not Installed"

Norton AntiVirus Dat Version

Version of Norton AntiVirus virus definitions

20040324

Looks for the registry key of Norton Antivirus dat version (consumer and corporate editions) and returns the version number. Returns "Not Installed" if the key does not exist.

if ((exists key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry) and (exists value "NAVNO_50_AP1" of key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry) OR ((exists key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry) and exists value "NAVNT_50_AP1" of key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry)) then (preceding text of last "." of following text of last "\" of (value "NAVNT_50_AP1" of key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry as string)) else if ((exists key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry) AND (exists value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry)) then (preceding text of last "." of following text of last "\" of (value "NAVCORP_70" of key "HKEY_LOCAL_MACHINE\Software\ Symantec\SharedDefs" of registry as string)) else "Not Installed"

McAfee Anti-Virus Dat Version

Version of McAfee Anti-Virus virus definitions

4.0.4343

Looks for the registry key of McAfee Anti-Virus dat version and returns the version number. Returns "Not Installed" if the key does not exist.

if (exists key "HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\VirusScan Engine\4.0.xx" of registry) then (value whose (name of it = "szVirDefVer" OR name of it = "szDatVersion") of key "HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\VirusScan Engine\4.0.xx" of registry as string) else "Not Installed"

TrendMicro Dat Version

Version of Trend Micro Office Scan Client virus definitions

844

Looks for the registry key of Trend Micro Office Scan dat version and returns the version number. Returns "Not Installed" if the key does not exist.

if (name of operating system as lowercase starts with "win9" or name of operating system = "WinME") then (if (exists key "HKEY_LOCAL_MACHINE\Software\ TrendMicro\OfficeScanCorp\CurrentVersion" of registry) then (value "Application Path" of key "HKEY_LOCAL_MACHINE\Software\ TrendMicro\OfficeScanCorp\CurrentVersion" of registry as string) else "Not Installed") else (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." of registry) then (value "PatternVer" of key "HKEY_LOCAL_MACHINE\SOFTWARE\ TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." of registry as string) else "Not Installed")

Trend Micro Office Scan Server Pattern Version

Version of Trend Micro Office Scan Server virus definitions

844

Looks for the registry key of Trend Micro Office Scan dat version and returns the version number. Returns "Not Installed" if the key does not exist.

if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ TrendMicro\OfficeScan\service\Information" of registry) then (names of files whose ( ((first 4 of following text of position 12 of it & first 2 of following text of position 17 of it & first 2 of following text of position 20 of it & first 2 of following text of position 23 of it & following text of position 31 of it)of (modification time of it as string)) as integer = (maximum of (((first 4 of following text of position 12 of it & first 2 of following text of position 17 of it & first 2 of following text of position 20 of it & first 2 of following text of position 23 of it) of (modification times of files whose (name of it as string contains "lpt") of folder ((value "Local_Path" of key "HKEY_LOCAL_MACHINE\SOFTWARE\ TrendMicro\OfficeScan\service\Information" of registry) as string )as string)) as integer)) ) of folder ((value "Local_Path" of key "HKEY_LOCAL_MACHINE\SOFTWARE\ TrendMicro\OfficeScan\service\Information" of registry) as string)) else ("n/a"))

eTrust Dat Version

Version of eTrust virus definitions

Mon, 14 Apr 2003 22:02:18 -0500

Looks for the registry key of eTrust dat version and returns the version number. Returns "Not Installed" if the key does not exist.

if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ ComputerAssociates\ScanEngine\Path" of registry) then (value "Engine" of key "HKEY_LOCAL_MACHINE\SOFTWARE\ ComputerAssociates\ScanEngine\Path" of registry as string) else "Not Installed"

 

Network

 

Property Name Description Example Return Value Additional Notes Relevance

MAC Address

MAC address of network adapter(s)

02-06-7b-34-bf-02

 

mac addresses of adapters of network

IP address(es) of computer

192.168.100.101

 

IP Address" value="addresses whose (it as string != "0.0.0.0") of ip interfaces whose (loopback of it = false) of network

 

Using DHCP?

Returns true if the network adapter is using DHCP

True/False

 

dhcp enableds of adapters of network

Network Adapter Description

Returns a hardware description of the network adapter

3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) - Packet Scheduler Miniport

 

descriptions of adapters of network

Using Dialup?

Returns true if a network adapter is using the PPP protocol (indicating that they are using a dialup connection)

True/False

Although most dial up connections use PPP, a PPP connection does not necessary mean the user is using a dial-up connection

exists ip interface whose (point to point of it = true) of network

Using LAN Connection?

Returns true if the network adapter is not using the PPP protocol (indicating that they are not using a dialup connection)

True/False

Although most LAN connections don't use PPP, the lack of a PPP connection does not necessary mean the user is using a LAN connection

exists ip interface whose (point to point of it = false and loopback of it=false) of network

Subnet Masks

Returns the subnet mask of the network adapters

255.255.255.0

 

subnet masks of ip interfaces whose (loopback of it = false) of network

Subnet Address

Subnet address(es) of computer

192.168.100.0

Returns the ip address masked with the subnet mask (i.e., IP address 192.168.100.123 and subnet mask 255.255.255.0 will return the subnet address of 192.168.100.0).

subnet addresses whose (it as string != "0.0.0.0") of ip interfaces whose (loopback of it = false) of network

 

Operating System

Property Name Description Example Return Value Additional Notes Relevance

Boot Time of OS

Time the computer last started

Tue, 10 Jun 2003 09:13:11 -0700

Time zone is included in time

boot time of operating system

Uptime

Amount of time since the computer last started (uptime)

13 days, 09:37:43.543

This will give you uptime to nearest millisecond

now - boot time of operating system

Uptime (days)

Number of days since the computer last started (without "days" description)

13

This will give you uptime to nearest day, which makes it easy to use when comparing numbers (i.e., restart the computer only if uptime > 15)

(now - boot time of operating system) / day

Uptime (days)

Number of days since the computer last started (without "days" description)

13 days

Same as above with the string "days" added to the end

((now - boot time of operating system) / day) as string & " days"

Time zone

Local time zone on the BigFix Client computer

-0700

 

local time zone

BigFix Client time

Local time on the BigFix Client computer

Tue, 24 Jun 2003 09:48:02 -0700

 

now

System language

Language of the system

English (United States)

This value is configurable from the Control Panel.

system language

User language

Language of the default user

English (United States)

This value is configurable from the Control Panel.

User language

Language of the OS

Language of the OS

English (United States)

Language of the original OS installation. This value determines which language the patches need to be to correctly apply.

language of version block of file "kernel32.dll" of system folder & (if (exists key "HKLM\System\CurrentControlSet\Control\ Nls\MUILanguages" of registry AND exists value of key "HKLM\System\CurrentControlSet\Control\ Nls\MUILanguages" of registry) then " - MUI Installed" else "")

OS Service Pack Level

The csd version of the Operating System (current Service Pack)

Service Pack 1

The return value of varies by OS

csd version of operating system

OS Serial Number

Microsoft OS serial number

44712-OEM-0024810-00403

 

if (exists wmi) then (string value of selects "SerialNumber from Win32_OperatingSystem" of wmi) else ("N/A")

Full OS Name

Complete Microsoft OS name

Microsoft Windows XP Professional

 

if (exists wmi) then (string values of selects "caption from win32_operatingsystem" of wmi) else ("N/A")

Full OS Name and Service Pack Level

Complete Microsoft OS name along with the service pack version

Microsoft Windows XP Professional Service Pack 1

 

if (exists wmi) then (string value of selects "caption from win32_operatingsystem" of wmi & " " & csd version of operating system) else ("N/A")

Domain/Workgroup

Domain or workgroup that the computer is a member of

bigfix.com

 

if (exists wmi) then (string values of selects "Domain from Win32_ComputerSystem" of wmi) else ("N/A")

Startup Applications

Applications that are set to run each time the computer starts

C:\Program Files\Common Files\Dell\EUSW\ Support.exe 

C:\Program Files\NavNT\vptray.exe 

The applications will run on startup if they are in the "startup" folder sfor the system or for the user or if they are in the "HKCU\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\Run" key or the "HKLM\SOFTWARE\ Microsoft\Windows\ CurrentVersion\Run" key

if (exists wmi) then (string values of selects "Command from Win32_StartupCommand where description != 'Desktop'" of wmi) else ("N/A")

Open Shares

Shares that are open on the computer (not including the default or admin shares)

MP3 Share 

Shared Docs 

 

if (exists wmi) then (string values of selects "name from win32_share where caption != 'Default Share' AND caption != 'Remote Admin' AND caption != 'Remote IPC'" of wmi) else ("N/A")

OS Type

Returns if a computer is a workstation or a server class operating system

Server/Workstation

All Win9x computers are considered to be workstations

if (name of operating system as lowercase starts with "win") then (if (name of operating system = "Win95" OR name of operating system = "Win98" or name of operating system = "WinME") then "Workstation" else (if (value "ProductType" of key "HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\ProductOptions" of registry = "WinNT") then "Workstation" else "Server")) else "Unknown - " & name of operating system

Firewall Status (Domain)

Returns information on the state of Windows XP Internet Connection Firewall. Only reports on the Firewall state for the Domain profile. Users may actively be using either the Domain or the Standard Profile.

Disabled on all connections

Firewall settings can be different for each profile but only one profile will currently be in use.

if (name of operating system = "WinXP" AND csd version of operating system contains "Service Pack 2") then (if (exists key "HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile" whose ((not exists value "EnableFirewall" of it) OR (value "EnableFirewall" of it = 1 AND (not exists value "DoNotAllowExceptions" of it OR value "DoNotAllowExceptions" of it = 0))) of registry) then (if ((exists internet connection firewall whose (enabled of it = false) of adapters of network) AND (exists internet connection firewall whose (enabled of it = true) of adapters of network)) then "Enabled and disabled connections exist" else if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then "Disabled on all connections" else "Enabled on all connections") else ("Disabled")) else if ((name of operating system = "WinXP" AND (csd version of operating system = "" OR csd version of operating system = "Service Pack 1"))) then (if ((exists internet connection firewall whose (enabled of it = false) of adapters of network) AND (exists internet connection firewall whose (enabled of it = true) of adapters of network)) then "Enabled and disabled connections exist" else if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then "Disabled on all connections" else "Enabled on all connections") else ("N/A")

Firewall Status (Standard)

Returns information on the state of Windows XP Internet Connection Firewall. Only reports on the Firewall state for the Standard profile. Users may actively be using either the Domain or the Standard Profile.

Enabled and disabled connections exist

Firewall settings can be different for each profile but only one profile will currently be in use.

if (name of operating system = "WinXP" AND csd version of operating system contains "Service Pack 2") then (if (exists key "HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy\StandardProfile" whose ((not exists value "EnableFirewall" of it) OR (value "EnableFirewall" of it = 1 AND (not exists value "DoNotAllowExceptions" of it OR value "DoNotAllowExceptions" of it = 0))) of registry) then (if ((exists internet connection firewall whose (enabled of it = false) of adapters of network) AND (exists internet connection firewall whose (enabled of it = true) of adapters of network)) then "Enabled and disabled connections exist" else if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then "Disabled on all connections" else "Enabled on all connections") else ("Disabled")) else if ((name of operating system = "WinXP" AND (csd version of operating system = "" OR csd version of operating system = "Service Pack 1"))) then (if ((exists internet connection firewall whose (enabled of it = false) of adapters of network) AND (exists internet connection firewall whose (enabled of it = true) of adapters of network)) then "Enabled and disabled connections exist" else if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then "Disabled on all connections" else "Enabled on all connections") else ("N/A")

Connections with Firewall Disabled (Domain)

Returns a description of the connections that have Windows XP Internet Connection Firewall disabled. Only reports on the Firewall settings for the Domain profile. Users may actively be using either the Domain or the Standard Profile.

Intel(R) PRO/Wireless 2200BG Network Connection - Packet Scheduler Miniport

Firewall settings can be different for each profile but only one profile will currently be in use.

if (name of operating system = "WinXP" AND csd version of operating system contains "Service Pack 2") then (if (exists key "HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile" whose ((not exists value "EnableFirewall" of it) OR (value "EnableFirewall" of it = 1 AND (not exists value "DoNotAllowExceptions" of it OR value "DoNotAllowExceptions" of it = 0))) of registry) then (if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then descriptions of adapters whose (enabled of internet connection firewall of it = false) of network else "Enabled on all connections") else (descriptions of adapters of network)) else if ((name of operating system = "WinXP" AND (csd version of operating system = "" OR csd version of operating system = "Service Pack 1"))) then (if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then descriptions of adapters whose (enabled of internet connection firewall of it = false) of network else "Enabled on all connections") else ("N/A")

Connections with Firewall Disabled (Standard)

Returns a description of the connections that have Windows XP Internet Connection Firewall disabled. Only reports on the Firewall settings for the Standard profile. Users may actively be using either the Domain or the Standard Profile.

VMware Virtual Ethernet Adapter for VMnet1

Firewall settings can be different for each profile but only one profile will currently be in use.

if (name of operating system = "WinXP" AND csd version of operating system contains "Service Pack 2") then (if (exists key "HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy\StandardProfile" whose ((not exists value "EnableFirewall" of it) OR (value "EnableFirewall" of it = 1 AND (not exists value "DoNotAllowExceptions" of it OR value "DoNotAllowExceptions" of it = 0))) of registry) then (if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then descriptions of adapters whose (enabled of internet connection firewall of it = false) of network else "Enabled on all connections") else (descriptions of adapters of network)) else if ((name of operating system = "WinXP" AND (csd version of operating system = "" OR csd version of operating system = "Service Pack 1"))) then (if (exists internet connection firewall whose (enabled of it = false) of adapters of network) then descriptions of adapters whose (enabled of internet connection firewall of it = false) of network else "Enabled on all connections") else ("N/A")

Simple File Sharing Enabled

This property will only detect simple file sharing for Windows XP.

Enabled

Disabled

Note:If the value does not exist or does not equal 1, it is considered disabled. 

if (name of operating system = "WinXP") then (if (exists value "ForceGuest" whose (it as integer = 1) of keys "HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\Lsa" of registry) then "Enabled" else "Disabled") else "N/A"

Local Administrators

Returns a list of the Administrators on the computer.

SYSTEM\Administrator

SYSTEM\Domain Admins

SYSTEM\john_smith

Note: please also see this KB article.

If ((it contains "Win" AND it != "Win98" AND it != "WinME") of name of operating system AND version of regapp "BESClient.exe" >= "6" AND exists local group "Administrators") then (members of local group "Administrators" as string) else "Unsupported Configuration"

x64 OS?

Returns TRUE if the current operating system is 64-bits.

True/False

 

if (name of operating system as lowercase contains "win") then (x64 of operating system) else (Architecture of Operating System contains "64")

 

Hardware

Property Name Description Example Return Value Additional Notes Relevance

Number of processors

Number of processors

1

 

number of processors

Number of Drives

Number of drives of all types

5

Includes removable drives, network drives, fixed drives, etc.

number of drives

CDROM drive installed?

Returns true if a CD ROM drive is installed

True/False

 

exists drive whose (type of it = "DRIVE_CDROM")

Number of Mapped Network Drives

Number of mapped network drives

8

 

number of drives whose (type of it = "DRIVE_REMOTE")

Computer Manufacturer

Computer Manufacturer

Dell Computer Corporation

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (string value of select "Manufacturer from Win32_ComputerSystem" of wmi) else ("N/A")

Computer Model

Computer Model

Inspiron 8200

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (string values of selects "Model from Win32_ComputerSystem" of wmi) else ("N/A")

Video Card

Video Card Information

NVIDIA GeForce2 MX/MX 400

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (string values of selects "Name from Win32_VideoController" of wmi) else ("N/A")

Sound Card

Sound Card Information

Crystal WDM Audio Codec

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (string values of selects "Name from Win32_SoundDevice" of wmi) else ("N/A")

Monitor

Monitor information

Dell M991

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (string values of selects "Name from Win32_DesktopMonitor" of wmi) else ("N/A")

CD Rom drive

CD Rom drive information

HL-DT-ST RW/DVD GCC-4240N

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (string values of selects "Caption from Win32_CDROMDrive" of wmi) else ("N/A")

Screen resolution

Screen resolution

1600 x 1200

This information is provided by the computer manufacturer and stored in the wmi

if (exists wmi) then (preceding text of last " x" of (string values of selects "VideoModeDescription from Win32_VideoController" of wmi)) else ("N/A")

Computer serial number or service tag

Computer serial number or service tag

8GYB012

This information is provided by the computer manufacturer and stored in the wmi (or dmi)

if (exists wmi) then (string values of selects "SerialNumber from Win32_BIOS" of wmi) else if (exists dmi AND exists serial_number of system_information of dmi) then (serial_number of system_information of dmi) else ("N/A")

Brand String of CPU

Processor information from vendor

Mobile Intel(R) Pentium(R) 4 - M CPU 1.70GHz

 

brand string of processor

Active Devices

List of objects corresponding to the active devices on the machine, e.g., modems, graphics cards, printers, etc.

3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) 

Actiontec MD56ORD V92 MDC Modem 

Only works on NT based computers

friendly names of active devices

 

File

Property Name Description Example Return Value Additional Notes Relevance

File System of C:

File system of drive "C:"

NTFS

 

file system type of drive "C:"

File system of each of the drives

C: - NTFS 

E: - FAT32

 

(name of it & " - " & (file system type of it)) of drives whose (exists file system type of it)

 

Percent free space on C:

Percentage of free space on C:

26

 

free space of drive "C:" * 100 / total space of drive "C:"

Percent free space on C:

Percentage of free space on C:

26 percent free

 

(free space of drive "C:" * 100 / total space of drive "C:") as string & " percent free"

Free space of drives

Free space on each fixed drive

C: - 4137 MB 

E: - 5386 MB

 

(name of it & " - " & (free space of it / 1000 / 1000) as string & " MB") of drives whose (type of it = "DRIVE_FIXED")

Total space of drives

Total space on each fixed drive

C: - 15726 MB 

E: - 14224 MB

 

(name of it & " - " & (total space of it / 1000 / 1000) as string & " MB") of drives whose (type of it = "DRIVE_FIXED")

Free and Total space of drives

Free space and total space of each fixed drive

C: - 4137 MB free of 15726 MB total 

E: - 5386 MB free of 14224 MB total

 

(name of it & " - " & (free space of it / 1000 / 1000) as string & " MB free of " & (total space of it / 1000 / 1000) as string & " MB total") of drives whose (type of it = "DRIVE_FIXED")

Percent free of drives

Percentage of free space on each fixed drive

C: - 26 percent free 

E: - 37 percent free

 

(name of it & " - " & (free space of it * 100 / total space of it) as string & " percent free") of drives whose (type of it = "DRIVE_FIXED")

Type of drives

Type of each drive

A: - DRIVE_REMOVABLE 

C: - DRIVE_FIXED 

D: - DRIVE_CDROM

Possible types of drives are "DRIVE_REMOVABLE", "DRIVE_FIXED", "DRIVE_CDROM", "DRIVE_REMOTE"

(name of it & " - " & type of it) of drives

 

User

Property Name Description Example Return Value Additional Notes Relevance

Local user information

Information about local username, user comments, account disabled info, administrative privileges, password disabled, password expired, password age, and last logon

Administrator -- Built-in account for administering the computer/domain -- Admin -- Last Logon: Sat, 15 Mar 2003 02:01:53 -0700 -- Password Age: 160 days 

Guest -- Built-in account for guest access to the computer/domain -- Account Disabled: Yes -- Password Age: 0 days 

...

Local users only refer to computers defined on the local computer (domain users are not included)

if (number of local users > 100) then error "Too many local users" else (name of it & (if (comment of it != "") then " -- " & comment of it else "") & (if (account disabled flag of it = TRUE) then " -- Account Disabled: Yes" else "") & (if (admin privilege of it = TRUE) then " -- Admin" else "") & (if (exists last logon of it) then " -- Last Logon: " & last logon of it as string else "") & (if (password expired of it = TRUE) then " -- Password Expired" else "") & " -- Password Age: " & (password age of it / day) as string & " days") of local users

Disabled local users?

Returns username and a True/False value indicating that the user is disabled

Administrator - False 

Guest - True 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & account disabled flag of it as string) of local users

Admin local users?

Returns username and a True/False value indicating that the user is an administrator

Administrator - True 

Guest - False 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & admin privilege of it as string) of local users

Last logon of local users

Returns username and a time indicating when the user last logged in

Administrator - Sat, 15 Mar 2003 02:01:53 -0700 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & last logon of it as string) of local users whose (exists last logon of it)

Password age of local users

Returns username and a time indicating the time since the password was last changed

Administrator - 160 days, 20:00:19 

Guest - 00:00:00 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & password age of it as string) of local users

No password required for local users?

Returns username and a True/False value indicating that no password is required for the user

Administrator - False 

Guest - False 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & no password required flag of it as string) of local users

Password expired for local users?

Returns username and a True/False value indicating that user's password has expired

Administrator - False 

Guest - False 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & password expired of it as string) of local users

Bad password account for local users

Returns username and the number of times the user has attempted to log in with an incorrect password

Administrator - 0 

Guest - 0 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & bad password count of it as string) of local users

Number of times logged in for local users

Returns username and the number of times the user has logged in to this computer

Administrator - 27 

Guest - 0 

 

if (number of local users > 100) then error "Too many local users" else (name of it & " - " & logon count of it as string) of local users

Full username

Fully qualified logged in username with domain info

BIGFIX\user_name

Will return "No User Logged In" if there isn't a current user

if (exists wmi) then (if (exists string value of selects "UserName from win32_computersystem" of wmi) then (string value of selects "UserName from win32_computersystem" of wmi) else ("No User Logged In")) else ("N/A")

 

Miscellaneous

Property Name Description Example Return Value Additional Notes Relevance

Is Laptop?

Returns true if a the computer has a battery (indicating it is a laptop)

True/False

If a laptop doesn't have a battery, it will return False for this property

if (exists wmi) then ((exists selects "* from win32_Battery" of wmi) as string) else ("N/A")

BigFix License Expiration

Returns the expiration date of the BigFix license

Tue, 24 Jun 2003 15:09:51 -0700

All BigFix Clients should return the same value

expiration date of client license

BigFix Client License State

The license state of the BigFix Client along its license number out of the total licenses allowed

Unrestricted - 12304/40000

This property will allow you to see how many licenses are actually being used in your BigFix deployment

seat count state of client license as string & " - " & seat of client license as string & "/" & maximum seat count of client license as string

 

Input Required Properties

Field Input

(Default values are examples)
Property Name Description Example Return Value Relevance

Registry Value "[valuename]"

Retrieve a registry value

TestValue

value "[valuename]" of key "[keyname]" of 

 

Application filename

exists regapp “[application filename]”

Returns true if specified registered application exists

True/False

exists regapp "[]"

Application filename

exists running application “[application filename]”

Returns true if specified running application exists

True/False

exists running application "[]"

Application filename

exists recent application “[application filename]”

Returns true if specified application was run recently

True/False

exists recent application "[]"

Service name

exists running service “[service name]”

Returns true if the specified service is running

True/False

exists running service "[]"

Service name

state of service “[service name]”

Returns state of the specified service (use the "Service name" and not the "Display name")

Running, Stopped, Stopping, Starting

state of service "[]"

Variable name

environment variable “[variable name]”

Returns the specified environment variable

[environment variable name]=[environment variable value]

variable "[]" of environment